● Covered by 4 sources · 4 reportsMedium impact4 neutral
Eye Security Disables Vulnerable Time4Popcorn Updater to Prevent Botnet Formation
Key points
- Eye Security disabled the updater for the abandoned "Time4Popcorn" app.
- Millions of devices were vulnerable to remote code execution (RCE) attacks.
- The vulnerability (CVE-2026-30612) was due to unencrypted updates.
- Attackers could have formed a botnet or performed surveillance.
- The action secured systems still connecting to defunct update servers.
- Eye Security pushed over 2 million updates between November 2025 and March 2026.
- The updater was on 2.5-3 million Windows PCs and 250,000-350,000 Macs.
- The vulnerability allowed arbitrary code execution with SYSTEM/root privileges.
- The original Popcorn Time shut down in 2014.
- Eye Security named the operation "Operation IXIM".
- Eye Security presented Operation IXIM at Hack.lu on October 22.
- Eye Security sinkholed the domains of the abandoned Popcorn Time fork.
- The updater ran in the background at system boot.
- The updater did not feature code signing.
- Eye Security registered the abandoned domain popcorntimeupd.xyz.
- The updater also affected Android devices.
Vulnerable Popcorn Time Fork Disabled
Researchers at Eye Security have taken action to disable a vulnerable updater service associated with "Time4Popcorn," a fork of the abandoned Popcorn Time application. This intervention was necessary to prevent potential remote code execution (RCE) attacks on millions of devices worldwide.
The "Time4Popcorn" app, which provided an interface for streaming torrented content, was still installed on numerous Windows, macOS, and Android devices. Its updater service continued to attempt connections to now-abandoned web domains over unencrypted HTTP, creating a significant security risk.
CVE-2026-30612 Identified
The security flaw, identified as CVE-2026-30612, allowed for unauthenticated code execution. This vulnerability arose because the updater communicated over unencrypted HTTP and accepted executables without verifying digital signatures. Consequently, anyone who gained control of the update domain could manipulate HTTP traffic and execute code with full privileges, such as SYSTEM on Windows and root on macOS.
Eye Security's Niels Teusink stated that this vulnerability could have been exploited to install and run virtually any software, enabling the creation of a botnet, targeted man-in-the-middle attacks, or surveillance.
Preventing a Botnet Threat
By registering the abandoned domain, popcorntimeupd.xyz, Eye Security observed up to 3 million Windows and 350,000 macOS client connections to Time4Popcorn. The researchers then pushed an update that specifically disabled the vulnerable updater service, effectively closing the security loophole.
This proactive measure prevented malicious actors from exploiting the millions of devices running the outdated and insecure software, which could have been coerced into a large-scale botnet.
Background of Popcorn Time
Popcorn Time gained popularity as an easy-to-use platform for streaming pirated movies and TV shows. While the original project was eventually abandoned, various forks, including "Time4Popcorn," emerged and attracted millions of users.
Despite the abandonment of development for years, the software remained installed on many devices, continuing to pose a security risk due to its outdated components and insecure update mechanism.
Updates
- Eye Security sinkholed the domains of the abandoned Popcorn Time fork.
- The updater ran in the background at system boot.
- The updater did not feature code signing.
- Eye Security registered the abandoned domain popcorntimeupd.xyz.
- The updater also affected Android devices.
- Eye Security pushed over 2 million updates between November 2025 and March 2026.
- The updater was on 2.5-3 million Windows PCs and 250,000-350,000 Macs.
- The vulnerability allowed arbitrary code execution with SYSTEM/root privileges.
- The original Popcorn Time shut down in 2014.
- Eye Security named the operation "Operation IXIM".
- Eye Security presented Operation IXIM at Hack.lu on October 22.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
CVE CVE-2026-306129.8 CRITICALHow outlets covered it
Eye Security researchers disabled a vulnerable update mechanism in an abandoned Popcorn Time fork, preventing potential remote code execution on millions of Windows, macOS, and Android devices. The updater, running in the background without code signing, could have delivered malicious executables with system privileges, affecting consumer, corporate, and government networks.
Eye Security pushed over 2 million updates to disable a vulnerable background updater in the abandoned Time4Popcorn application between November 2025 and March 2026. This updater, present on an estimated 2.5-3 million Windows PCs and 250,000-350,000 Macs, could have allowed an attacker to execute arbitrary code with SYSTEM/root privileges, potentially leading to ransomware, data theft, or botnet recruitment.
Researchers remotely disabled a vulnerable updater in the Time4Popcorn app, a fork of Popcorn Time, preventing potential remote code execution (RCE) attacks on millions of Windows and macOS devices. The vulnerability, CVE-2026-30612, allowed unauthenticated code execution due to unencrypted HTTP updates and lack of digital signature verification from an abandoned domain. This action secured systems that were still attempting to connect to the defunct update server.
Eye Security researchers took control of abandoned domains used by the "Time4Popcorn" app to push an update that disabled its updater service. This action prevented millions of devices running outdated, vulnerable software from being exploited to form a botnet.